CVE-2026-13356
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.
Risk Assessment
An attacker could exploit this vulnerability to perform a phishing attack by displaying a fake URL in the address bar, potentially tricking users into revealing sensitive information.
Recommendation
Immediately update Firefox for iOS to version 152.3 or later to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.